Oracle Java support for Adobe ColdFusion

<p>We have some positive news to share with you! Support and distribution of Oracle Java SE, including all maintenance updates of Long-Term Support (LTS) releases (Oracle Java SE 8 and Oracle Java SE 11), will be supported by Adobe directly for all ColdFusion customers making use of the Oracle Java technology. All customers will need to abide by Oracle’s terms of use as they have previously. The support covers the use of all Oracle Java SE releases, current and future, for ColdFusion […]</p>
<p>The post <a rel="nofollow" href="https://coldfusion.adobe.com/2019/01/oracle-java-support-adobe-coldfusion/">Oracle Java support for Adobe ColdFusion</a> appeared first on <a rel="nofollow" href="https://coldfusion.adobe.com">ColdFusion</a>.</p>

Thank you Rakshith and the Adobe CF team, this is the best possible outcome. It's also good news that you'll be making CF 2016 compatible with Java 11 too. Do you recommend customers to upgrade to Java 11 and what are the key benefits please? (Presumably an upgrade guide will be provided with the next CF update?) Thanks again.

Rakshith: Thanks for the update on this. To be completely clear, does this also mean that use of Oracle's Java SE 8 and 11 in production environments, when used with Adobe ColdFusion, is allowed without the Adobe customer purchasing a separate license from Oracle for that Java use?

Great news Rakshith and Team!
I do have one question, once the Java 8 release ends public updates (after January 2019), how does a ColdFusion customer download them? For Java 7 and below the <em>non-public</em> updates are only avaliable if you login to Oracle to download them.

Yep, really wonderful news to hear--and folks should read the comments here, which make some things more clear: that we will not need to purchase from Oracle either support for updates to Oracle Java 8 (which will no longer be free publicly after this month), nor to license Oracle Java 11 in production (also not free otherwise).
Some may not quite see this as what Rakshith's is saying, as he says that we who are using CF would be "supported by Adobe directly" to get Java 8 updates and use Java 11 . That phrasing left questions, and Rakshith clarified them in answers/comments here.
I have also updated <a href="https://www.carehart.org/blog/client/index.cfm/2018/11/15/on_production_use_of_java_going_forward" rel="nofollow">my blog post talking about the issue</a> (for those to whom this whole java 8/11 licensing question may be news).
Thanks very much, Rakshith and to the CF team and management for solving this for us.

It would be nice to (eventually) get a clear definition of what "for ColdFusion customers to run their ColdFusion applications" means. For example, we have developed substantial amount of custom Java code for use as part of our CF apps. We access the code from CF via CreateObject("java"...) and other mechanisms that allow bridging CF and Java. I would think that this clearly counts as part of "running a CF application", but there can be less clear situations.
I would also like to know if the ability to download Java updates will be restricted to purchasers of currently supported CF versionsonly (11, 2016, 2018). We have some unsupported versions in production (10, 11) running on Java 8. While I don't expect CF to support these versions of CF as such, would we be at least entitled to download the updates for Java 8 (and use at our own risk)?

Minor correction: I meant to write supported CF versions (2016, 2018), unsupported version (10) and very soon unsupported (11). In other words this is a pertinent question for CF 11 users as well, will we still be able to download Java 8 updates after CF 11 support ends?

Yogesh, what has that question to do with this blog post? You should create a "question" (instead of a comment on a blog post).
And beyond that please add there more detail on what you are seeing, the version of cf, and so on.

Many thanks for this information, Rakshith.
I'd be very grateful if you could clarify just one more thing. For those of us who have manually updated Java for CF, where the update is installed outside the ColdFusion root, e.g.
C:\Java\jdk1.8.0_191\jre
is this covered under Adobe's agreement with Oracle, or do updates need to be installed within the ColdFusion installation root (C:\ColdFusion2016\jre)?
(I should add that the updated version installed outside the CF root is used exclusively on the server for CF and the CF-packaged version of Jetty).

Good, so this means we can stick with Java 8? We have some compiled third-party code, which would break if there was a new Java version required in a future update. So I am glad to here we can stick with Java 8 (unless I misunderstood).

Michael, I realize you will want to hear from Adobe, or better to see the legal terms. But as this is about covering use of Java by CF, I can't imagine it would somehow be tied to the directory where Java is installed, but instead only to its use by CF (and that bundled jetty server for the Add-on service, only).
To give still more credence to this, note that Adobe DOES recommend we keep the JVM updated (to the latest minor release of the major release supported by a given CF version and update), and when they tell us to update Java, they DO tell us to install it where it normally goes--outside of the CF folder.
(FWIW, some folks have mistakenly told their Java installer to implement itself within CF, leading often to trouble. If nothing else, it's also then impossible to easily revert back to the previous Java version.)
So again, bottom line, I realize you need to hear it from Adobe, but it would be shocking if somehow the license was tied to "where" Java was installed. But your covering bases, so I understand the question. :-)

Kevin, I realize you are asking Adobe, but since it's in reply to my comment I'll just add that the answer would seemingly be yes, unless you mean that "compiled third-party code" was being used OUTSIDE of CF. If you mean only that you'd call those Java objects from within CFML, then yep this license covers the use of Java by CF.
Still, I suppose (like Michael Clark's question above about whether it matters "where" Java is installed), you are just covering your bases. Let's see what else Adobe may say.

Legoral San, as long as every Java access is from within a CF application, you are fine.
You can use Java on unsupported ColdFusion versions too at your own risk. I will recommend that you move them to supported versions as soon as possible.

I apologize if this has already been answered but I'm not seeing it at the moment. At least not specifically mentioned. In order to be covered to use Java with ColdFusion must we install only those versions provided by Adobe? What I mean is, going forward as Oracle continues to update Java with security fixes and such, will we have to wait for Adobe to provide a Java download for us to use with ColdFusion or can we continue to get the latest Java updates directly from Oracle's website and still be covered to use it?

Further to Miguel's questioning:
Why did/is Adobe using the Java PSU (Patch Set Updates) version, rather than the Java CPU (Critical Patch Updates) version?
With Java 8/9/10 there was a Server JRE (ideal for production environment - that excluded development tools and client-side browser components) - Java 11 doesn't seem to have a Server JRE version - should we therefore just be using the ZIP version? Is it safe for production or does it still contain development tools, etc?

Wolf, yes, Adobe supplies the JVM updates, or you can get them from Oracle.
They are on the CF downloads page:
https://www.adobe.com/support/coldfusion/downloads.html#additionalThirdPartyInstallers
And that is pointed to from the technotes for the updates released on Feb 12 when Java 11 support was added (CF2018 u2, CF2016 u8).
FWIW, the later updates from Feb 22 (or Mar 1) do NOT point to that list, which may be why you didn't notice that the JVM downloads exist. Instead, they point folks back to the previous release to read more (though only suggesting it's about "bug fixes"). We can hope they may improve that.
And while the downloads page does offer the latest Java 8 update also (202 only, not 201), curiously the technote for CF11 u16 (also released on Feb 12) does NOT point to the downloads page. That seems an oversight.
And some have complained that they would like to see the Java 8 201 update as well, and more than just the jdk for 8).

<em>Well after posting my comment to WolfShade, I now see Charlie’s reply. It was not there before so my reply is out of context. I’m not sure we want to rely on Adobe keeping the Java downloads page(s?) up to date.</em>I have asked the same question here and on the CFML Slack channel. No response. I don’t get it. It is a pretty straight forward question.

Miguel, you say “no response” to wolf’s question. Please confirm you see mine here, right above yours, replying to his question in depth. Or is it that you prefer to hear from Adobe directly? If so, what particularly in my reply is not sufficient. Sincere question, not a snark.

Odd, as my reply to wolf was from yesterday. Anyway, as I said to him, you don't HAVE to use the Adobe downloads. Use the oracle ones.
They are binary the same.
See Adobe offering them as a convenience for now..
But I know: you and others will want to hear from Adobe. I'm just trying to fill the void when I can.

No worries Charlie. When I clicked to reply to this thread I did not see your comment (the one before mine). It was not there. I promise. It was only after I posted my reply that I saw your comment. Even though yours was posted hours before mine. ????
So from your reply, we will be able to download updated versions of Java from Adobe <em>OR</em> Oracle and still be covered under Adobe's agreement with the Oracle license. Did you get that from Adobe? I have not seen it posted anywhere.

If they are binary the same how could it possibly make a difference? Again, I know people want to hear more from Adobe on this licensing issue. I have asked also above, for a definitive licensing agreement. That we CANNOT infer from the installers.

Again, I agree on the need for us to be a able to see and reference a legal agreement between Adobe and Oracle, on behalf of CF users. 100%.
It's the matter of installers where I'm simply sharing facts, where I can.

And thank you for that Charlie. I truly appreciate it! I just don't understand how the folks at Adobe are not chiming in. It seems to me a very straight forward question. The lack of a response from them, on various channels, is making me wonder if that is true.

If what is true, you mean whether one of the questions is straightforward? Which one do you mean then?
As for why they may not respond, well they don't seem committed to answering every comment addressed to them here. We could hope they would, but clearly no one seems to follow every comment the way some of us in the community do. We can surely wish they would and that clear and important unresolved questions could be ensured to be answered. (Anyone remember the old cf community manager position, which was a paid Adobe role?)
And as for slack, I don't follow it (just can't stand the lack of structure or easy review of previous comments in a given thread, perhaps from days ago, as we can do here or in any web forum or mailing list).
But I know it used to be Anit Panda who watched that for the cf team. He left Adobe last month, announcing that (so not just disappearing on us). If no one at Adobe has stepped in to fill that void on slack, and won't, and won't here, then we're back to getting what we get only when we can get it. Not perfect, but we can all pitch in as we usually have had to, helping each other as we can, and pressing Adobe when we need their response.
You can also email cfsup@adobe.com or cfinstal@adobe.com. Sometimes they will answer directly a question you can't seem to get answered publicly.

I am referring to my original question; do we have to get updated Java installers from Adobe or can we get them directly from Oracle and remain under the Adobe licensing agreement with them.
Regarding Slack, yes I'm aware Anit has left and he was great at responding. However, there are other Adobe folks chiming in on other questions in the Slack channel, but not mine (I also posted this question over there). Which just heightens my fear that there is more to this then we know.

I think it's that any legal question has to go through hoops to get a statement. As for the downloads, you can read the oracle agreement. It says nothing about where you get them.. It just says you need to have licensed it to use it in prod. That's why we need THAT question (about the license) answered more clearly, I'd argue.

Charlie, I have gotten a reply from Adobe on the CFML Slack channel. I will post their reply here as a new comment so it is not buried in these replies. Interested to hear your take on it. Unfortunately it is not a very detailed response.

I received a response to my question from Sandip Halder of Adobe over on the CFML Slack channel. I am reposting his reply here for others to see. My question was<blockquote>In order to stay within the Oracle Java license agreement do we have to use the Java installers from Adobe or can we still get them from Oracle when needed?</blockquote> Sandip’s reply was simply<blockquote>We checked this and you would have to use Java installers from Adobe and not from Oracle.</blockquote>Wil then asked:<blockquote>Are the installers from Adobe different? and is this for Java 8 or both Java 8 and Java 11?</blockquote>To which Sandip replied:<blockquote>Will, installers are same but license attached to them are different and this is for both Java 8 and 11.</blockquote>For those signed up on the CFML Slack here is a link to his comment – <a href="https://cfml.slack.com/archives/C06TABBT8/p1552070787188800" rel="nofollow">https://cfml.slack.com/archives/C06TABBT8/p1552070787188800</a> <em>Ugh, after editing this comment all formatting has been lost.</em>